SquirrelMail plugins compromised [LWN.net]

From:		Jon Angliss <jon-AT-squirrelmail.org>
To:		squirrelmail-announce-AT-lists.sourceforge.net
Subject:		[SM-ANNOUNCE] SECURITY: SquirrelMail Web Server Status, and Plugins Update
Date:		Thu, 30 Jul 2009 23:42:28 -0500
Cc:		squirrelmail-plugins-AT-lists.sourceforge.net, squirrelmail-users-AT-lists.sourceforge.net, squirrelmail-admins-AT-lists.sourceforge.net, squirrelmail-devel-AT-lists.sourceforge.net

All,

We apologies for the extended downtime for the SquirrelMail plugins
repository, and some of the SquirrelMail site documentation.
Unfortunately due to conflicting time schedules, and some
miss-communications amongst the team (mostly my fault), the server
was unavailable for an extended length of time.

Server Status
-------------
This evening, after an extended downtime, we finally rolled to using
the new server.  XS4All.nl were gracious in loaning us an additional
server whilst we migrated our data, to the new server.  All
documentation should now be online again, and active.  If you notice
any issues with the site, please feel free to email me directly,
I'll get onto it as soon as I can.

Plugins Compromise
------------------
During the initial announcement, we'd mentioned that we did not
believe that any of the plugins had been compromised.  Further
investigation has shown that the following plugins were indeed
compromised:

  - sasql-3.2.0
  - multilogin-2.4-1.2.9
  - change_pass-3.0-1.4.0

Parts of these code changes attempts to send mail to an offsite
server containing passwords.  We cannot establish a timeline of when
these plugins were compromised.  If you are a user of these plugins,
it is strongly recommended you download a fresh copy from the
plugins repository.  MD5s for the good versions are below:

a492922e5b0d2245d4e9bc255a7c5755  sasql-3.2.0.tar.gz
b143f2dc82f9e98dd43c632855255075  multilogin-2.4-1.2.9.tar.gz
2cff7c5d4f6f5d8455683bb5d96bb9fe  change_pass-3.0-1.4.0.tar.gz


Plugins Availability
--------------------
As of now, the plugins are available to download again.  I
personally apologies for the extended outage of this, as I know some
of you have been eager to get these back up and running again.  Once
again, if you notice any issues with the site, feel free to email.


--
Jon Angliss
<jon@squirrelmail.org>

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

to post comments

SquirrelMail plugins compromised

Posted Jul 31, 2009 17:31 UTC (Fri) by MattPerry (guest, #46341) [Link] (1 responses)

Again? These people just can't secure their servers.

SquirrelMail plugins compromised

Posted Aug 1, 2009 7:01 UTC (Sat) by drag (guest, #31333) [Link]

Linux folks have not really made that easy lately... so it's easier said then done.

http://pwnie-awards.org/2009/awards.html

> Linux

> Continually assuming that all kernel memory corruption bugs are only Denial-of-Service

> The Linux kernel development team was nominated several times over for their ongoing lack of handling of bugs of "unknown impact" and generally assuming that all kernel memory corruption issues are only Denial-of-Service issues. Here's a hint: Just because you can only get a DoS from a bug, doesn't mean that skilled hackers can't get a root shell out of it.

SquirrelMail plugins compromised

Posted Aug 1, 2009 6:22 UTC (Sat) by muwlgr (guest, #35359) [Link] (3 responses)

Why not just track your code in a kind of VCS ?

SquirrelMail plugins compromised

Posted Aug 1, 2009 10:45 UTC (Sat) by gebi (guest, #59940) [Link]

ack, just use git and make gpg signed tags for every release.

SquirrelMail plugins compromised

Posted Aug 3, 2009 10:40 UTC (Mon) by nix (subscriber, #2304) [Link] (1 responses)

Hell, if they even took *backups* they could tell when the plugins were compromised to some degree of precision.

SquirrelMail plugins compromised

Posted Aug 6, 2009 9:45 UTC (Thu) by alex (subscriber, #1355) [Link]

It would be useful if they could at least offer a diff so I can check the code on my server and see if it has the same exploit code.